After a quarterly risk review, the CISO notices that the same risk has been reported as 'high' for the past three quarters despite a treatment plan being in place. What is the most appropriate action to improve the risk management process?

Remove the risk from the register because the treatment plan is not working.

Investigate why the treatment plan is not reducing the risk and adjust the plan or risk response.

Escalate the risk to the board of directors immediately.

Continue reporting the risk as 'high' until the risk owner changes the rating.

Which activity is a key component of an ongoing risk monitoring process?

Deleting risks from the register once a control is implemented

Waiting for an audit finding to identify risk changes

Reviewing risk indicators and control effectiveness on a scheduled basis

Conducting a one-time risk assessment at the start of a project

Certified Information Security Manager

Domain 2Objective 6

Risk Monitoring and Reporting CISM Practice Questions (Page 8)

Part of the Domain 2: Information Security Risk Management domain, which accounts for 20% of the CISM exam.

37questions here

8free pages

9concepts

20%of the exam

Questions 36–37

36application · medium
After a quarterly risk review, the CISO notices that the same risk has been reported as 'high' for the past three quarters despite a treatment plan being in place. What is the most appropriate action to improve the risk management process?
Select an answer first
37foundation · easy
Which activity is a key component of an ongoing risk monitoring process?
Select an answer first

Finished these 2 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to CISM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISACA. “CISM” is a trademark of its owner, used for identification only.

Risk Monitoring and Reporting CISM Practice Questions (Page 8)

Questions 36–37

After a quarterly risk review, the CISO notices that the same risk has been reported as 'high' for the past three quarters despite a treatment plan being in place. What is the most appropriate action to improve the risk management process?

Which activity is a key component of an ongoing risk monitoring process?

Keep studying — Domain 2: Information Security Risk Management